# Engineering execution: build evidence

Date: 22 September 2026 (UTC). Branch: `codex/encrypted-expo-flow`. Foundation PR: [#69](https://github.com/cairnhold/coz/pull/69). This branch builds on that foundation and integrates the existing unified-spec branch from [#62](https://github.com/cairnhold/coz/pull/62). It does not mark the full production roadmap complete.

## Implemented

- Shared companion ports and explicit Hermes/fixture adapters from the foundation.
- One native Expo module with shared Swift wire models/transport, device Keychain, background lock and AES-GCM durable request journal. Fixture work and unified task submissions share the queue.
- Synthetic save preference → select exact input → review draft → activate → review result → accept/cancel UI. Unknown outcomes retain the same immutable request ID; signed rejection is terminal.
- Explicit encryption of existing chats/drafts with serialized IO, readback verification, interrupted-copy recovery and safe plaintext cleanup after commit. No automatic migration; attachments and historical backups remain outside this change.
- Integrated unified job-spec, agent catalog, matching and Mac/Jev implementation. No live Jev call was made in this execution.
- Local-model UTF-8 context limit, bounded streaming response parsing and cancellation/deadline.
- Signed agent-evidence preflight: trusted independent signer, immutable bundle/schema/model/suite/environment bindings, limits, expiry, current revocation and failed-safety rejection. Execution remains false.
- Deterministic contract source/schema hash inventory and implemented relay endpoint/encrypted command audit.

## Verification

| Check | Evidence | Limit |
|---|---|---|
| `npm run check:all` | Pass: 49 root + 119 mobile Node + 81 Python tests (249), both TypeScript checks, schema/audit generation and root web build | Synthetic fixtures; no live provider |
| `npm run mobile:export` | iOS/web export checked after shared-module Metro configuration | JavaScript exports are separate from native execution |
| Full Expo `Coz.xcworkspace` Xcode build | Pass: iOS 17 target, unsigned generic Simulator, Xcode 26.6 (17F113), actual CozVault module | No physical device or signed Keychain/UI test |
| `npm run check:native-transport` | macOS and iPhone SDK Swift typechecks; Node→Swift and Swift→Node HPKE/Ed25519 pass | Temporary synthetic keys |
| `npm run test:native-journal` | Ciphertext canary, restart identity, same-ID prepare, conflicting payload/queue rejection, wrong key/device, retained receipt and corrupt-file preservation pass | Does not establish lost-device recovery |
| `npm run test:native-flow` | Actual Swift transport against separate disposable coordinator/node processes: save/select/draft/run/review/accept, duplicate activation produces one attempt, private-to-shared denial, no plaintext canary in relay or persisted state | Pair persistence injected to avoid the user's Keychain; not phone UI evidence |
| Migration failure injection | 25 failure boundaries plus post-commit resume, readback failure, unavailable native storage and concurrent IO regressions pass | Process-interruption model; no power-loss or backup-erasure claim |
| Signed evidence preflight | Tampering, changed bundle, revoked publisher/evaluator/bundle, expiry, self-evaluation, suite/model/capability/resource mismatch and failed safety tests pass | Synthetic signatures/evaluation fixtures, not real independent evals |

On this Mac, ExpoModulesJSI's nested build initially failed because it placed signed intermediates inside synced Documents. Its local dependency build script was adjusted to use `/private/tmp/coz-expo-jsi-derived`; application DerivedData uses `/private/tmp/coz-expo-encrypted-native`. This was a temporary build-environment workaround, not a tracked Expo dependency patch. CocoaPods 1.16.2 was installed into temporary Ruby directories; generated native folders and dependencies are ignored. The tracked Expo config plugin sets both Pod and application deployment targets to iOS 17.

## Remaining work and blockers

- **#2/#4:** physical iPhone custom-build installation and complete UI/Keychain/lock flow; production enrollment and coordination.
- **#5 / CRY-01/02/06, DEC-02/04:** owner recovery and replica choice, backup format/restore drill, attachment migration. The pending recovery choice was not inferred from elapsed time.
- **#6 / DEC-05:** select and verify an OS isolation host; whole-process denial/cancellation/resource evidence and contained Hermes. This machine has no configured container/VM runtime; no live Hermes process was restarted or given Vault access.
- **#7:** independent household custody and membership epochs. Two fixture principals on one trusted host are not two independent owners.
- **#8 / BLK-01, CON-01:** occurrence scheduler, single-owner migration and adopted effect convergence/money decisions. Saved schedule/watch specs are not running schedules. No effects or payments enabled.
- **#9/#10:** evaluator/distribution infrastructure and canonical OWP conformance. Original Notion baseline attachments remain unavailable through the connector; its page text and attachment references were verified, but original bytes were not obtained.

All release gates remain false. Real personal data, remote execution, arbitrary packages, payments and external effects are not enabled by passing these tests.

## Shared preview integration

[Draft PR #73](https://github.com/cairnhold/coz/pull/73) contains the implementation. Integration starts from shared preview `1318c74`, preserving concurrent card-input contracts, submission feedback and port methods. Combined `check:all` passes **261 tests** (49 root, 123 mobile Node, 89 Python), both TypeScript checks, root build and iOS/web exports. The contract audit includes the concurrent companion-input schemas. Browser verification shows both debug flows unavailable and history migration disabled without the native module, with no console warnings/errors. No live backend was connected.